In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions before 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
apache solr |
Vulmon